Skip to content

docs: add PRIVACY.md #401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imran-siddique merged 1 commit into from
Jul 16, 2026
Merged

docs: add PRIVACY.md #401

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions PRIVACY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Privacy

cMCP is a self-hosted gateway that you deploy and operate. agentrust-io and OPAQUE run no service on your behalf and receive no data from your deployment: cMCP sends no telemetry, analytics, or usage data to us.

What cMCP processes: as an MCP gateway, cMCP handles the MCP requests and responses that pass through it in order to enforce policy and produce attestation. This traffic is processed inside the trusted execution environment (TEE) you run and is governed by your own configuration and your privacy commitments to your users. cMCP is designed so that a privileged operator cannot silently exfiltrate this data.

What cMCP records: cMCP can emit signed TRACE records (metadata such as model, policy hash, data class, and tool-call digests) to the destinations you configure. It writes only what your policy specifies, where you specify.

As the operator, you are the data controller for traffic through your cMCP deployment. This notice describes the software's behavior, not a hosted service.

Questions or corrections: https://github.com/agentrust-io/cmcp/issues